SPF, DKIM, and DMARC Passed. The File Was Malware.

Every authentication check on this email passed. SPF, DKIM, DMARC, ARC, and Microsoft's composite compauth=pass reason=100. The message was not spoofed, not forged, not relayed through some sketchy intermediary. It came, genuinely and verifiably, from a real audiovisual technology vendor that has been in business since 2004. And the spreadsheet stapled to it was flagged malicious by file scanning.

That is the whole lesson in one sentence: authentication tells you who sent a message. It tells you nothing about what they attached.

A CEO, a two-word note, and a booby-trapped spreadsheet

The recipient was the chief executive of a large hospitality and resort operator. The email body was almost aggressively unremarkable: a bare "good morning," a one-line "see attached for your review," and a "thanks." Below it sat an embedded image of a corporate signature block, CFO and COO title, phone number, website. No links. No urgency. No payment demand. Just a spreadsheet named after the sending company and a polite request to open it.

The sender was a real person at a real firm, a two-decade-old vendor whose Microsoft 365 mailbox had been compromised. This is vendor email compromise: the attacker was not impersonating the vendor from a lookalike domain. They were logged into the vendor's actual account, sending from the vendor's actual infrastructure. That is why every check passed. The domain published valid SPF and DKIM records, the mail flowed through the vendor's legitimate Microsoft 365 tenant, and DMARC aligned perfectly under a p=quarantine policy. There was no authentication signal to fail on, because nothing was faked.

The message was also self-addressed. The From and To headers both named the vendor's own mailbox, with the real targets delivered by BCC, the classic fingerprint of a compromised account blasting its contact list rather than a considered one-to-one note. This was the sender's first message to this recipient, and it went straight for the CEO.

Why the attachment is the entire attack

There is no malicious link here to sandbox, no credential page to blocklist, no fresh domain to flag. The payload is the file, and the file arrived wearing the vendor's credentials.

File scanning returned a verdict of malicious on the spreadsheet, a roughly 138 KB workbook. The clean image in the signature block scanned fine and served only to make the message look routine. We are being deliberate about what we do not claim: the sample could not be detonated from the incident extraction, so we are not going to invent a macro chain or a specific dropper behavior. What we know is concrete enough. A known-bad spreadsheet, confirmed by scanning, was delivered to an executive inbox by a sender that every gateway control had already decided to trust.

That trust is the exploit. Verizon's 2026 Data Breach Investigations Report puts malware-laden messages at roughly 10 percent of the gateway attack mix, a minority of volume but a disproportionate share of the damage when one lands. And the human element remains central to breaches: the same report attributes 62 percent of breaches to it. A spreadsheet from a recognized vendor, authenticated end to end, is about as low-friction a delivery vehicle as attackers get.

MITRE mapping

The core technique is Spearphishing Attachment (T1566.001): a malicious file delivered by email to a specific, high-value target. Because the payload only activates when the recipient opens it, the attack also depends on User Execution of a Malicious File (T1204.002). The delivery mechanism, a hijacked legitimate mailbox, maps to Valid Accounts (T1078). Attackers used real, authorized credentials, which is precisely why the traffic looked normal to every reputation and authentication check in the path.

See Your Risk: Calculate how many threats your SEG is missing

Indicators of compromise

What actually caught it

If SPF, DKIM, and DMARC all pass, a secure email gateway leaning on authentication and sender reputation has no reason to hold this message. The sender's domain had a spotless twenty-year history and impeccable auth. Reputation-based filtering was designed to wave exactly this kind of mail through, and across our customer base secure email gateways miss roughly 67.5 phishing emails per 100 mailboxes every month.

Themis, our Adaptive AI, evaluated the signals that authentication ignores. A first-time sender reaching a VIP mailbox. An image-based signature standing in for real text. And, decisively, a file-scan verdict of malicious on the attachment. It flagged the message at 90 percent confidence, tagged it as an image-based attack against a VIP recipient, and quarantined every copy across the affected mailboxes before anyone opened the file.

That is the difference between checking identity and assessing intent. Effective malware and malicious-attachment protection has to treat a perfectly authenticated file as guilty until scanned, because the FBI's 2024 IC3 report makes clear that business-context email attacks, including vendor and partner compromise, remain among the costliest categories organizations face. CISA's phishing guidance says the same thing in operational terms: authentication is a control against spoofing, not a clearance for content.

The takeaway

Vendor email compromise turns your suppliers' good reputation into your attack surface. When a message clears every authentication check, that is a statement about the envelope, not the contents. Treat authenticated mail from established senders as trustworthy in origin and unproven in payload, scan every attachment regardless of how clean the sender looks, and give first-time-sender-to-VIP patterns the scrutiny they deserve. The vendor did not send you this file. Someone wearing the vendor's login did.